Enforce root host filesystem boundary

[omry]

---

Stack created with Sapling. Best reviewed with ReviewStack.

• Add controlled-session lifecycle state machine #18
• Add controlled-session framed protocol #17
• Define controlled-session authorization #16
• Make queued admission cancellation deterministic #15
• Enforce coarse application network policy #14
• Protect host system trees from runtime binds #13
• -> Enforce root host filesystem boundary #12
• Add container-local runtime identities #11
• Verify application sandbox at startup #10
• Harden application container identity and kernel policy #9
• Unify application sandbox planning #8
• Document controlled sessions and repositories #7

[Copilot]

Pull request overview

This PR enforces a stricter security boundary for root (UID 0) application runtimes by rejecting any host filesystem authority (host input binds, shared-state binds, and explicit output binds) before Docker container creation, and by rejecting root one-shot output options before any host-path preparation.

Changes:

• Extend runtime host-source tracking with an Authority classification (input vs shared-state vs explicit-output) and validate it against the locked runtime policy.
• Enforce “root runtime cannot use host binds / explicit output” across readiness gating, lifecycle execution, and provider install flows, with early-fail semantics.
• Add targeted test coverage and update design/docs + changelog fragment for the new root host authority contract.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
internal/probe/local_account_linux_test.go	Adds coverage that root runtime account realization rewrites passwd entry deterministically.
internal/dockerdeploy/runtime_readiness.go	Threads runtime UID into host-source validation during runtime readiness gating.
internal/dockerdeploy/runtime_readiness_test.go	Adds coverage that root host binds are rejected before running a published container; updates readiness test inputs for authority.
internal/dockerdeploy/runtime_host_preflight.go	Introduces Authority classification and enforces root runtime host-bind/output rejection in host-source validation.
internal/dockerdeploy/runtime_host_preflight_test.go	Expands unit coverage for authority drift, root rejection behavior, and early root rejection before host inspection.
internal/dockerdeploy/provider_install_run.go	Adds early root host-authority validation for install plans before building/preparing destination.
internal/dockerdeploy/provider_install_run_test.go	Verifies install rejects root host binds before build/destination mutation.
internal/dockerdeploy/provider_install_lifecycle_execute.go	Updates lifecycle executor wiring to pass runtime policy for per-command host-source validation.
internal/dockerdeploy/one_shot_output.go	Rejects root runtime use of --output-dir/--output-file before creating/claiming host paths.
internal/dockerdeploy/one_shot_output_test.go	Adds regression test ensuring root is rejected before filesystem mutation; makes helper robust when tests run as root.
internal/dockerdeploy/environment_lifecycle_executor.go	Validates lifecycle command host sources against runtime policy (including root rejection) before running containers.
internal/dockerdeploy/environment_lifecycle_executor_test.go	New tests covering lifecycle root bind rejection and host-kind enforcement.
docs/CONTROLLED_SESSION_DESIGN.md	Documents the root host authority enforcement and clarifies pre-container enforcement semantics.
docs/BLUEPRINT_ENVIRONMENT_MODEL.md	Updates the blueprint contract description for root runtime restrictions (binds + output options).
docs/BACKLOG.md	Updates backlog items to reflect remaining open work (root warning + special file confinement).
.changes/unreleased/+root-host-authority.yaml	Adds a Security changelog fragment for the new root host authority rejection behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[omry]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: f7282c826a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[omry]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: c1226568e1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".